Whamcloud - gitweb
LU-10026 sptlrpc: don't crash for too-large chunk size 45/57845/8
authorAndreas Dilger <adilger@whamcloud.com>
Thu, 9 Nov 2023 00:10:05 +0000 (17:10 -0700)
committerOleg Drokin <green@whamcloud.com>
Fri, 25 Apr 2025 00:54:22 +0000 (00:54 +0000)
If the chunk size is too large, don't fall off the
end of the page_pool[] array with a large "order".

EX-bug-id: EX-8270
Test-Parameters: trivial
Fixes: d945f1b064 ("EX-6261 ptlrpc: extend sec bulk functionality")
Signed-off-by: Andreas Dilger <adilger@whamcloud.com>
Signed-off-by: Artem Blagodarenko <ablagodarenko@ddn.com>
Change-Id: I9cdf059860cab3c22857766dba5617358f0aaba9
Reviewed-on: https://review.whamcloud.com/c/fs/lustre-release/+/57845
Reviewed-by: Sergey Cheremencev <scherementsev@ddn.com>
Reviewed-by: Oleg Drokin <green@whamcloud.com>
Tested-by: jenkins <devops@whamcloud.com>
Tested-by: Maloo <maloo@whamcloud.com>
lustre/obdclass/page_pools.c

index 37d5090..6be8b7e 100644 (file)
@@ -680,16 +680,13 @@ static inline int __obd_pool_get_objects(void *array, unsigned int count,
                                       unsigned int order,
                                       void **(*object_from)(void *, int))
 {
-       struct obd_page_pool *page_pool = page_pools[order];
+       struct obd_page_pool *page_pool;
        wait_queue_entry_t waitlink;
        unsigned long this_idle = -1;
        u64 tick_ns = 0;
        int p_idx, g_idx;
        int i, rc = 0;
 
-       if (!array || count <= 0 || count > page_pool->opp_max_objects)
-               return -EINVAL;
-
        if (order >= pools_count) {
                CDEBUG(D_SEC,
                       "Requested pool order %d too big, max allocated order %d (chunk size %lu): %d\n",
@@ -698,6 +695,10 @@ static inline int __obd_pool_get_objects(void *array, unsigned int count,
                return -EINVAL;
        }
 
+       if (!array || count <= 0 || count > page_pools[order]->opp_max_objects)
+               return -EINVAL;
+
+       page_pool = page_pools[order];
        spin_lock(&page_pool->opp_lock);
 
        page_pool->opp_st_access++;